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using the results of the correlating to provide well-informed accounting information 
related to the flow to the accounting application. 




(Once Amended) The method of claim 6, whermn using comprises: 
reporting a transaction stop indication in response to the change of the given flow state to 
the rejected state. 



9. (Once Amended) The method of claim 2,ycorrelating further comprises: 
processing the captured IP packet. 




9. (Once Amended) A computer program product residingyon a computer-readable medium 
br analyzing a flow for an accounting application, comprising instructions to cause a computer 
to: 

capture an IP packet from a network segment; 

determine if the captured IP packet includes a it/essage of a first protocol type for 
providing error reporting, the message having an embedded IP packet that triggered an error 
event, the embedded IP packet being of a second ppotocol type and having a flow associated 
therewith; 

correlate the flow associated with the er^bedded IP packet to a stored parent flow of a 
given state to associate the error event with the given state of the stored parent flow; and 

use results of the correlating to proyde well-informed accounting information related to 
the flow to the accounting application. 



20. (Once Amended) The computer program product of claim 19, wherein the first protocol 
is the Internet Control Message Protocol. 



21 . (Once Amended) The camputer program product of claim 19, wherein the second 
protocol type is the Transmission Control Protocol. 
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(Once Amended) The computer program product of claim 19, wherein the first protocol 
^ , ^y^^P^ Internet Control Message Protocol and the second protocol type is the Transmission 




Control Protocol. 



(Once Amended) A system for flow of network packey data, comprising: 
a processor; 

a memory storing a computer program product resi^mg on a computer-readable medium 
for analyzing a flow for an accounting application, co/hprising instructions to cause a 
computer to: 

capture an IP packet from a network segment; 

determine if the captured IP packet includes a/message of the first protocol type for 
providing error reporting, the message having an eirmedded IP packet that triggered an error 
event, the embedded IP packet being of the seconcy protocol type and having a flow associated 
therewith; 

correlate the flow associated with the erjfbedded IP packet to a stored parent flow of a 
given state to associate the error event with thef given state of the stored parent flow; and 

use the results of the correlating to provide well-informed accounting information related 
to the flow to the accounting application. 

?6. (Once Amended) The system of claim 24 wherein the first prot09{)l is the Internet Control 
Message Protocol. 



27. (Once Amended) The system of claim 24 wherein the secjmd protocol type is the 
Transmission Control Protocol. 



28. (Once Amended) The system of claim 24 wherein the first protocol type is the Internet 
Control Message Protocol and the second protocol type isrthe Transmission Control Protocol. 



